Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample261027-v4v43aeb62
- SHA256 7c2dbac6ba5c6fbbc6ce4ac1ccec544ca2161acac2b18b168508968474cdab1d
- MD5 51a1bfd3a778525c22cef28769b62a0c
- SHA1 51e6e81112a45a71b94b5510cabac494dcf8010f
- SHA512 1a5584993f4b59fd6a06640816472b5353f30426cf6deb45bf9ff8903901df905f30a5e1e0ad760c5f10805072b67c22364d5347201585bd680d922c87d75082
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLNzhA5+8+emxjA20tfVwa78NB9OW9qobEXN2a:NU5rCOTeijMc6+/9OW9k92yaVTZwlH
- TLSH T1D8B4E025B589C132E59301710ED6EBA22E3A7D74572294C73B94633E2FB13E1E3B5346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4280 6.tmp 2588 A2.tmp 736 16D.tmp 4180 20A.tmp 1712 287.tmp 1104 342.tmp 2040 3BF.tmp 3196 45B.tmp 2000 4C9.tmp 4344 546.tmp 4536 5C3.tmp 884 640.tmp 2036 6AD.tmp 2452 749.tmp 4680 7D6.tmp 4284 863.tmp 4748 8E0.tmp 2216 97C.tmp 988 9E9.tmp 4772 A66.tmp 4736 B22.tmp 2468 BBE.tmp 4724 C5A.tmp 3328 CF6.tmp 4024 D93.tmp 4196 E2F.tmp 1900 E9C.tmp 3048 EFA.tmp 3688 F67.tmp 3508 FC5.tmp 3124 1033.tmp 1228 10B0.tmp 3636 116B.tmp 900 11F8.tmp 3152 1246.tmp 640 12A4.tmp 3752 12F2.tmp 4072 1340.tmp 4864 138E.tmp 2208 13EC.tmp 5064 1449.tmp 4188 1498.tmp 3096 14E6.tmp 1092 1543.tmp 3228 15B1.tmp 764 15FF.tmp 4100 164D.tmp 4804 169B.tmp 2268 1709.tmp 3848 1757.tmp 2812 17A5.tmp 2148 1812.tmp 2932 1870.tmp 4472 18BE.tmp 3588 191C.tmp 2464 196A.tmp 664 19B8.tmp 2972 1A54.tmp 5116 1AA2.tmp 3280 1AF1.tmp 3036 1B3F.tmp 3308 1B8D.tmp 4816 1BEB.tmp 1304 1C39.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1907.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4280 1540 2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe 84 PID 4280 wrote to memory of 2588 4280 6.tmp 85 PID 2588 wrote to memory of 736 2588 A2.tmp 86 PID 736 wrote to memory of 4180 736 16D.tmp 87 PID 4180 wrote to memory of 1712 4180 20A.tmp 88 PID 1712 wrote to memory of 1104 1712 287.tmp 89 PID 1104 wrote to memory of 2040 1104 342.tmp 90 PID 2040 wrote to memory of 3196 2040 3BF.tmp 91 PID 3196 wrote to memory of 2000 3196 45B.tmp 92 PID 2000 wrote to memory of 4344 2000 4C9.tmp 93 PID 4344 wrote to memory of 4536 4344 546.tmp 94 PID 4536 wrote to memory of 884 4536 5C3.tmp 95 PID 884 wrote to memory of 2036 884 640.tmp 96 PID 2036 wrote to memory of 2452 2036 6AD.tmp 97 PID 2452 wrote to memory of 4680 2452 749.tmp 98 PID 4680 wrote to memory of 4284 4680 7D6.tmp 99 PID 4284 wrote to memory of 4748 4284 863.tmp 100 PID 4748 wrote to memory of 2216 4748 8E0.tmp 101 PID 2216 wrote to memory of 988 2216 97C.tmp 102 PID 988 wrote to memory of 4772 988 9E9.tmp 105 PID 4772 wrote to memory of 4736 4772 A66.tmp 106 PID 4736 wrote to memory of 2468 4736 B22.tmp 107 PID 2468 wrote to memory of 4724 2468 BBE.tmp 108 PID 4724 wrote to memory of 3328 4724 C5A.tmp 109 PID 3328 wrote to memory of 4024 3328 CF6.tmp 110 PID 4024 wrote to memory of 4196 4024 D93.tmp 111 PID 4196 wrote to memory of 1900 4196 E2F.tmp 112 PID 1900 wrote to memory of 3048 1900 E9C.tmp 114 PID 3048 wrote to memory of 3688 3048 EFA.tmp 115 PID 3688 wrote to memory of 3508 3688 F67.tmp 117 PID 3508 wrote to memory of 3124 3508 FC5.tmp 118 PID 3124 wrote to memory of 1228 3124 1033.tmp 119 PID 1228 wrote to memory of 3636 1228 10B0.tmp 120 PID 3636 wrote to memory of 900 3636 116B.tmp 121 PID 900 wrote to memory of 3152 900 11F8.tmp 122 PID 3152 wrote to memory of 640 3152 1246.tmp 123 PID 640 wrote to memory of 3752 640 12A4.tmp 124 PID 3752 wrote to memory of 4072 3752 12F2.tmp 125 PID 4072 wrote to memory of 4864 4072 1340.tmp 126 PID 4864 wrote to memory of 2208 4864 138E.tmp 127 PID 2208 wrote to memory of 5064 2208 13EC.tmp 128 PID 5064 wrote to memory of 4188 5064 1449.tmp 129 PID 4188 wrote to memory of 3096 4188 1498.tmp 130 PID 3096 wrote to memory of 1092 3096 14E6.tmp 131 PID 1092 wrote to memory of 3228 1092 1543.tmp 132 PID 3228 wrote to memory of 764 3228 15B1.tmp 133 PID 764 wrote to memory of 4100 764 15FF.tmp 134 PID 4100 wrote to memory of 4804 4100 164D.tmp 135 PID 4804 wrote to memory of 2268 4804 169B.tmp 136 PID 2268 wrote to memory of 3848 2268 1709.tmp 137 PID 3848 wrote to memory of 2812 3848 1757.tmp 138 PID 2812 wrote to memory of 2148 2812 17A5.tmp 139 PID 2148 wrote to memory of 2932 2148 1812.tmp 140 PID 2932 wrote to memory of 4472 2932 1870.tmp 141 PID 4472 wrote to memory of 3588 4472 18BE.tmp 142 PID 3588 wrote to memory of 2464 3588 191C.tmp 143 PID 2464 wrote to memory of 664 2464 196A.tmp 144 PID 1636 wrote to memory of 2972 1636 1A06.tmp 146 PID 2972 wrote to memory of 5116 2972 1A54.tmp 147 PID 5116 wrote to memory of 3280 5116 1AA2.tmp 149 PID 3280 wrote to memory of 3036 3280 1AF1.tmp 150 PID 3036 wrote to memory of 3308 3036 1B3F.tmp 151 PID 3308 wrote to memory of 4816 3308 1B8D.tmp 152 PID 4816 wrote to memory of 1304 4816 1BEB.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\16D.tmp"C:\Users\Admin\AppData\Local\Temp\16D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\20A.tmp"C:\Users\Admin\AppData\Local\Temp\20A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\287.tmp"C:\Users\Admin\AppData\Local\Temp\287.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\342.tmp"C:\Users\Admin\AppData\Local\Temp\342.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\45B.tmp"C:\Users\Admin\AppData\Local\Temp\45B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\640.tmp"C:\Users\Admin\AppData\Local\Temp\640.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\7D6.tmp"C:\Users\Admin\AppData\Local\Temp\7D6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\8E0.tmp"C:\Users\Admin\AppData\Local\Temp\8E0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\97C.tmp"C:\Users\Admin\AppData\Local\Temp\97C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9E9.tmp"C:\Users\Admin\AppData\Local\Temp\9E9.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\BBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBE.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\CF6.tmp"C:\Users\Admin\AppData\Local\Temp\CF6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F67.tmp"C:\Users\Admin\AppData\Local\Temp\F67.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\FC5.tmp"C:\Users\Admin\AppData\Local\Temp\FC5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\1246.tmp"C:\Users\Admin\AppData\Local\Temp\1246.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\12A4.tmp"C:\Users\Admin\AppData\Local\Temp\12A4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\12F2.tmp"C:\Users\Admin\AppData\Local\Temp\12F2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\1340.tmp"C:\Users\Admin\AppData\Local\Temp\1340.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\138E.tmp"C:\Users\Admin\AppData\Local\Temp\138E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1812.tmp"C:\Users\Admin\AppData\Local\Temp\1812.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"58⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"59⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1C39.tmp"C:\Users\Admin\AppData\Local\Temp\1C39.tmp"66⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"67⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"68⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"69⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"70⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"71⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"72⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"73⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"74⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\1F27.tmp"C:\Users\Admin\AppData\Local\Temp\1F27.tmp"75⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"76⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"77⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"78⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"79⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\20AD.tmp"C:\Users\Admin\AppData\Local\Temp\20AD.tmp"80⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"81⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"82⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"83⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2215.tmp"C:\Users\Admin\AppData\Local\Temp\2215.tmp"84⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"85⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"86⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"87⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"88⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\23BB.tmp"C:\Users\Admin\AppData\Local\Temp\23BB.tmp"89⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"90⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"91⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"92⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"93⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\2560.tmp"C:\Users\Admin\AppData\Local\Temp\2560.tmp"94⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\25BE.tmp"C:\Users\Admin\AppData\Local\Temp\25BE.tmp"95⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"96⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"97⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"98⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"99⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"100⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\27B2.tmp"C:\Users\Admin\AppData\Local\Temp\27B2.tmp"101⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"103⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"104⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"105⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"106⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\29A6.tmp"C:\Users\Admin\AppData\Local\Temp\29A6.tmp"107⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"108⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"109⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"110⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"111⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"112⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"113⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"114⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2C36.tmp"C:\Users\Admin\AppData\Local\Temp\2C36.tmp"115⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"116⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"117⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"118⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2D6F.tmp"C:\Users\Admin\AppData\Local\Temp\2D6F.tmp"119⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"120⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"121⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"122⤵PID:3476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-